Problem Description
The physical process, in this case in the form of a vessel, may be influenced by external events like a change in wind, waves and current, or by unexpected events like loss of motor power for one or more propellers, or failure in the function of a rudder. It is desired or expected that the control system for the vessel can handle external influence and external events so as for the vessel to maintain a safe state. A safe state may for example be that that the vessel maintains the desired position or velocity, or that it avoids undesired positions (to avoid collision or grounding), that it avoids a situation of uncontrolled drift, that it maintains a desired course, etc. Moreover, it is expected that the control system in the case of loss of sensor signals or errors in sensors should not do undesired and unfortunate compensations like a sudden change in ballast pumping in response to loss of a realistic signal in a roll or pitch sensor, or sudden corrections of an apparent error in position.
Measurements to a Control System
A control system for a ship, with inputs from instruments that give measurements, and with outputs to actuators, propelling devices and control devices that are to be given control signals, is shown in FIG. 1 and in FIG. 3. This type of control system can receive measurements in the form of sensor signals from a number of sources: roll/pitch/heave sensors, anemometer for measuring relative wind speed and direction, gyro compass, GPS sensors or GPS positioning systems, inertial navigation systems that on basis of acceleration measurements calculate velocity by integration with respect to time and position by double integration with respect to time, hydroacoustic position sensors relative to fixed points at the sea-floor, taut-wire system of which the direction and length of one or more tensioned wires from the vessel to points at the sea floor is observed, command signals for change of course or desired course, desired position, or desired velocity of the vessel, shaft or and load on propellers and motors, rudder angle sensor, level sensors for loading tanks, ballast level sensors, fuel level sensors, engine state, cooling water temperature, oil pressure, etc.
The control system is to give control signals to actuators like propulsors and control devices. The propulsors may be ordinary propellers, tunnel thrusters or azimuth thrusters, or in some cases, a mooring system that is designed to pull the vessel to the right position. Control signals can also be given to ballast pumps and associated valves to correct the roll angle or the pitch angle.
Problems Related to Control for Dynamic Positioning, DP.
If the vessel is a petroleum drilling vessel or a petroleum production vessel, for example a drilling ship or a drilling platform, a petroleum production ship or a petroleum production platform, the control system may also receive measurements of the heave motion from a heave accelerometer, and output a control signal to an active heave compensation system for a riser, a drill string, cranes, etc. where mechanical equipment may be connected to the seafloor and of which it may be essential to compensate for the motion of the vessel, in particular heave. A normal use of control systems for petroleum activity at sea is for dynamic positioning of the vessel, that is, that the vessel uses actuators like azimuth thrusters to maintain desired position during drilling or during production of petroleum. A vessel that is moored and may rotate about a rotating turret with mooring lines to the seafloor may also have a control system that gives a varying control signal to propellers or thrusters to assist in keeping the desired position when the vessel is rotated because the direction of the weather or current changes, so that the thrusters contribute with forces to compensate for changes in the tension of mooring lines when the forces turn. Similarly, it may be envisaged that that the control system can give control signals to increase or decrease tension in the mooring lines of the same reason.
Problems Related to Testing of Control Systems of Vessels.
A ship inspector can visit a vessel and conduct a test on board of the control system. The test on board can be performed by disconnecting or connecting sensor systems, and to monitor the response of the system in different failure situations. However, to make a realistic test of the vessel for conditions that are to be expected, it is necessary to wait for or to seek weather situations and sea states that rarely occur or that can be dangerous. It will hardly be considered as an option to expose the vessel to extreme situations, like abnormally large errors in ballast distribution. In order to check if the control system provides control signals for correct compensation of the error, such kind of tests will normally not be conducted.
It is possible to perform a simulation of sensor data to the control system on board and monitor which control signals that the control system gives to actuators like propellers, rudders and thrusters, but this requires a local interconnection of the control system to a test system and is not done presently as far as the applicants knows. A disadvantage of visiting the vessel to be tested is often related to a long way of travel for the ship inspector, that the ship inspector must bring equipment for interconnection to the control system inputs for measurements, and equipment for interconnection to the control system outputs for response in the form of control signals that are normally sent to the actuators of the vessel, and in addition a data library that at least has to include the configuration of the actual vessel to be tested. Moreover, the travel time from a vessel that is to be tested and certified, to a next vessel, can make it difficult for the inspector to perform inspections sufficiently quickly, so that the next vessel will have to wait longer than necessary, with the economic disadvantages caused by the waiting, if the vessel cannot be taken into use without testing and certification. It may also cause a concealed physical danger to use a vessel where lack of testing of the control system does not reveal possible errors.
This means that there is a need for more efficient testing of vessel control systems, in particular because the vessels can be geographically remote from each other, and in practice not easily accessible for an inspector.
In factory production of a control system it is usual to perform a so-called factory acceptance test (FAT) of the control system (including hardware and software) where the manufacturer feeds simulated sensor data to the control system and monitors the control signals the control system gives in response. This type of FAT can only reveal errors where measurements from sources that the manufacturer has foreseen to exist, and where the control signals are only for equipment that the manufacturer have foreseen. Thus, it will not be known with certainty how the control system will interact with equipment, systems, configurations or situations that the manufacturer of the control system has not foreseen. In addition, in a FAT the control system will not be tested in the actual constellation where the control system is installed and connected for use on the vessel.
Example of a Practical Problem in Dynamic Positioning.
In dynamic positioning of a vessel (4) that is held in desired position by propellers, rudders or thrusters of the tunnel or azimuth type, it may be essential for the operation that the vessel keeps its position. Several events may be undesired. One may experience loss of motor power for one or more propellers or rudders, and have to increase the motor power on the remaining propellers and/or thrusters and perhaps rotate the remaining rudders or thrusters. One may also experience serious errors where the control system loses some of the signals from the connected sensors so that an undesired incident may occur. The inventors have knowledge of an instance where a vessel, in this case an drilling platform, was lying at a fixed position in the open sea and was drilling a drilling hole for a petroleum well in the seafloor, where the drilling platform held the desired position by means of so-called dynamic positioning or “DP”, that is, the control system was tuned to hold the vessel in the desired position by means of position measurements and motor power, without the use of mooring lines to the seafloor. The drilling platform was equipped with a double set of DGPS receivers that calculate the geographic position of the vessel based on radio signals received from a number of navigation satellites. In addition the drilling platform was equipped with a double set of hydroacoustic position sensors that measured the position of the vessel with respect to transponders at fixed points on the seafloor. At a given time during drilling, with riser connection to the drilling hole and active drilling, an event occurred so that the DGPS receivers showed a sudden change in position of about 75 meters, although no such change in position had actually occurred. The hydroacoustic sensors showed a stable position at the desired position over the drill hole. The control system continued to control propellers and rudders, and the drilling platform was without interruption held at the correct dynamic position, on basis of the signals. However, it turned out that after 5 minutes the drilling platform suddenly started to move towards the desired position according to the then erroneous DGPS signals. It was necessary to discontinue the drilling with the associated emergency procedures that among other things involved disconnection of the riser and cutting of the drill string. This type of situation can involve a risk for blowout of gas and oil, or pollution by spilling of drilling fluid. This type of situation can also present a risk to vessel and crew. This type of discontinued DP-drilling may thus be very expensive to start up again. The applicants assume that the initial sudden change of the position calculated by the DGPS receivers can have been caused by disturbances in the signal transmission from the GPS satellites to the receivers, or by a situation with an insufficient number of available satellites. The loss of the DGPS signal can have been ignored by the control system because of quality conditions in the software of the control system that require that such a calculated position must have been stable in the preceding 5 minutes to be considered to be real. In this way sudden changes in position due to erroneous signals are avoided. However, the new and changed, but nevertheless stable position calculated from the DGPS receivers can after 5 minutes have been regarded as stable and therefore reliable by the control system, and may have been given a higher priority than the measurements from the hydroacoustic transponders. This may be the reason why the control system attempted to control the drilling platform to the new position that the control system had evidently interpreted as the desired position, although drilling was in progress and the hydroacoustic measured position indicated that the position should be kept unchanged.
Problems Related to Changed Configurations in a Vessel: Reprogramming of a Control System
After a control system has been put to use in a vessel there will in many cases be a need for reprogramming or modification of the software in the control system. The purpose for doing this can be a need for changing numerical values related to alarm limits and acceptable variation in a sensor signal in the algorithm of the program, or it can be a need for the introduction of new tests and functions in the control system. When the reprogramming or modification of the software is completed there is a need for testing the control system to see if the changes have given the intended effect, and to check whether new and unintended errors have appeared as a consequence of the modifications. At present, satisfactory test equipment and procedures are not available for the testing of the control systems on a vessel after such changes.
Modifications in an Existing Control System, E.G. when Replacing Cranes.
Marine operations, related to oil and gas exploration and production, are made by vessels with cranes for installation and replacement of modules on the seafloor. This type of crane has control systems that compensate for the vertical motion of the vessel. The mode of operation and the function of the crane in safety-critical situations will to a large extent depend on the detailed design of the software of the control system, which will vary from one crane to another. Procedures have been established for the testing of the mechanical design of such cranes. In contrast to this there are no established systems or methods for the testing of the software of the crane control systems. The reason for this is that the response of the crane will depend on the sea state and the motion of the vessel in addition to the mechanical design and the control system of the crane. A required detailed testing of a crane system on a vessel should therefore involve both the dynamics of the vessel including the relevant control systems of the vessel, and in addition, the dynamics of the crane including the control system of the crane.
Repair/Replacement of Sensors for a Control System.
When sensors for a control system are replaced or modified, there is a need for adjustment of alarm limits for limits for acceptable variations in the sensor signals. It is customary for a control system to have redundant sensor systems so that several sensors may be used to measure the same physical quantity. As an example of this, the position of a vessel can be measured by inertial sensors, two or more GPS-receivers and two hydroacoustic sensor systems. From these measurement data the position of the vessel is determined by means of an algorithm in the control system. This algorithm will depend on the properties of the various sensors with respect to accuracy and properties like long term stability versus accuracy under rapid position variations. Replacement or modification of a sensor introduces the need for testing of the total sensor system to investigate whether the resulting combination of sensors provides acceptable position measurements for use in a control system.
Repair/Modification/Replacement of Actuators.
After replacement or modification of an actuator, a control system may give a significantly different response for the vessel. The reason is that a new or modified actuator may give a different control action to the vessel than what was assumed in the development of the control system. An example of this is in the use of thrusters for dynamic positioning, where the relation between the shaft speed of the thruster and the thrust must be known when the control system is tuned. If a thruster is changed, then the relation between the shaft speed of the thruster and the thrust may be changed, and it will be necessary to test the vessel with the control system to investigate if the system still performs satisfactorily.
Thus there is a need for a more effective testing of vessel control systems, also in the cases where the vessel has been modified from its previous configuration, and where old and new components of the vessel have not been previously combined, and has to be tested in the new combination.
Known Art in the Field.
The U.S. Pat. No. 6,298,318 “Real-time IMU signal emulation method for test of guidance navigation and control systems” describes an emulation method for testing of a plane by emulating the motion using a so-called 6 degrees-of-freedom (6 DOF) flight simulator and where signals from a so-called inertial navigation module to a guidance, navigation and control system on board the aircraft are generated by simulation. This U.S. patent does not discuss problems related to dynamic positioning of a vessel in drilling operations or some other form of stationary operation, it does not mention the use of cranes, navigation of connected underwater equipment, integration of hydroacoustic positioning equipment, problems related to ballasting, and does not consider ocean waves. A ship will normally not have 6 DOF, but instead 3 DOF as it has restoring action in heave/roll/and pitch motion.
The U.S. Pat. No. 5,023,791 “Automated test apparatus for aircraft flight controls” describes an automated test apparatus for the testing of flight control systems of an aircraft as part of an integrated system for testing a plurality of flight control systems. The automated test apparatus includes a system controller having memory for storing programmed instructions that control operation of the automated test apparatus, and for storing resulting flight controls system test data. The automated test apparatus includes a keyboard, a touch-screen, and a tape drive for entering programmed instructions and other information into the automated test apparatus, and for outputting test data from the system controller. Instruments included in the automated test apparatus and controlled by the system controller generate test signals that are input to the aircraft's flight controls system, and monitor resulting test data signals that are produced by the flight controls system. The automated test apparatus is connected by an interface cable to an onboard central maintenance computer included in the aircraft. The central maintenance computer includes a non-volatile memory that is programmed to run onboard tests of the flight controls system, and is controlled by the system controller during testing in accordance with the programmed instructions to run the onboard tests.
U.S. Pat. No. 5,541,863 “Virtual integrated software testbed for avionics” describes a virtual integrated software testbed for avionics which allows avionics software to be developed on a host computer using a collection of computer programs running simultaneously as processes and synchronized by a central process. The software testbed disclosed uses separate synchronized processes, permits signals from an avionics device to be generated by a simulation running on the host computer or from actual equipment and data bus signals coming from and going to actual avionics hardware is connected to their virtual bus counterparts in the host computer on a real-time basis.
U.S. Pat. No. 5,260,874 “Aircraft flight emulation test system” describes an aircraft test system that generates stimuli that emulate the stimuli received by an aircraft when in flight. The aircraft test system includes a number of instruments for generating the number of processor-controllable instruments for generating stimuli received by an aircraft when in flight. The system also includes a number of instruments that monitor the response of the various aircraft components to the stimuli to which the aircraft is exposed. A processor in response to the output signal from the aircraft components directs the stimuli generating instruments to produce stimuli that emulate those received by the aircraft as it moves through the air. The system thus generates an initial set of stimuli similar to what an aircraft would be exposed to when in flight; monitors the response of the aircraft to the stimuli to which it is exposed; and, in response generates an updated set of stimuli to the aircraft. The system also records the response of the output responses of aircraft components so that they could be monitored by personnel charged with insuring that the aircraft is functioning properly. The system can also be used to train flight crews since it can be used to place the aircraft “in the loop” during a flight emulation.
U.S. Pat. No. 6,505,574 “A vertical motion compensation for a crane's load” describes a method and a system for reducing sea state induced vertical motion of a shipboard crane's load using winch encoders, boom angle sensor, turning angle sensor and motion sensor that all feed measurements into a central processor that controls the crane on basis of the measurements and the commands from a crane operator.